1. Assessment of an Automated Touchdown Detection Algorithm for the Orion Crew Module 

• Synopsis : This paper describes the method used for automatically detecting touchdown of the Orion 
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for roll orientation. 
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• Abstract : Orion Crew Module (CM) touchdown detection is critical to activating the post-landing 
sequence that safe’s the Reaction Control Jets (RCS), ensures that the vehicle remains upright, and 
establishes communication with recovery forces. In order to accommodate safe landing of an 
unmanned vehicle or incapacitated crew, an onboard automated detection system is required. An 
Orion-specific touchdown detection algorithm was developed and evaluated to differentiate landing 
impact from in-flight events. The proposed method would be used to initiate cutting of the parachute 
riser lines, decrease the probability of CM rollover, and to terminate RCS jet firing prior to 
submersion. The RCS jets continue to fire until touchdown to maintain proper CM orientation with 
respect to the flight path and to limit impact loads, but have potentially hazardous consequences if 
submerged while firing. The time available after impact to cut risers and initiate the CM Up-righting 
System (CMUS) is measured in minutes, whereas the time from touchdown to RCS jet submersion is a 
function of descent velocity, sea state conditions, and is likely on the order of a second or less. 
Evaluation of the detection algorithms was performed for in-flight events (descent under main chutes) 
using hi-fidelity rigid body analyses in the Decelerator Systems Simulation (DSS), whereas water 
impacts were simulated using a rigid finite element model of the Orion CM in LS-DYNA. In addition 
to simulation, parachute drop test data and vehicle mockup impact drop test data were analyzed to 
assess detection performance. 

The Orion touchdown detection method was designed to be simple yet robust using only sensed 
Inertial Measurement Unit (IMU) data. There will be three IMU’s onboard the Orion CM providing 
fault tolerance and fault isolation capability. The IMU’s are robust and reliable navigation hardware 
that provide vehicle accelerations, rates, delta-v’s, and delta-theta’s to formulate a center of gravity 
(c.g.) acceleration magnitude and an accumulated delta-v magnitude. The detection algorithm checks 
these values against given thresholds to determine impact. Using the magnitude eliminates the need to 
know the vehicle’s orientation. The delta-v is accumulated over a given sliding time window. This 
accumulation has been tested as a running sum in an arbitrary inertial frame and as a simple 
summation in the rotating body (or sensor) frame. 

Touchdown detection is used to initiate two key events: RCS roll jet firing termination and riser cutting 
of the main parachutes. RCS jets have never been tested to fire under water or even splashed with 
water. There is much concern that firing the jets in a “wet” condition could pose a potentially serious 
threat to the vehicle and the crew. Consequently, it is desired to terminate jet firing prior to 
submersion. Terminating the jets early has proven infeasible while maintaining the desired vehicle 



orientation upon impact. Thus, rapid impact detection is needed to shutdown the jets before they 
become submerged. Results of this study show that rapid impact detection is possible with the Orion- 
specific detection algorithm. 

Six hundred and twenty five unique water landings were simulated using explicit finite element 
modeling and fluid structure interaction techniques in LS-DYNA (v971) to determine time-to-thruster 
submersion (TTS). Initial conditions of each simulated water impact was determined from a Monte 
Carlo dataset of descent under the Orion parachutes at various horizontal and vertical velocities, CM 
pitch angles, and sea state conditions to investigate the relationship between TTS, vehicle kinematics, 
and settings of the detection algorithm. 

While the accumulated delta-v method was sufficient to terminate the jets before submersion for all 
impacts tested, the acceleration method was much faster (producing more margin). The acceleration 
method however, was less robust to false early detections. In order to achieve the desired margin 
against early detections while ensuring that the jets were terminated prior to submersion, both methods 
were employed using an “or” logic trigger. The accumulated delta-v method caught any of the impacts 
that the acceleration method missed (acceleration thresholds had to be set higher to avoid early 
detections). While the accumulated delta-v method was slower, it was still fast enough, and the low- 
impact cases had a slower TTS. An alternate approach was also evaluated where the accumulated 
delta-v method was used to re-initiate RCS firing in the event that an early false detection occurred 
with the acceleration method. In this scenario, if the delta-v method did not confirm impact within a 
given time, the jets were reactivated and the trigger logic was reset. This would add protection for 
early false detections that could lead to improper vehicle orientation at impact, which could be 
hazardous to the vehicle and crew at high horizontal velocities. 

The other key touchdown detection event is cutting the main parachute riser lines. While it is not the 
only reason the CM can rotate upside down, parachutes dragging the CM in the wind is one of two 
main contributors (the other being excessive horizontal velocity). Consequently, it is desired to cut the 
parachute riser lines as quickly as possible. If onboard, the crew will likely be Prime for this action, 
while the automated detection algorithm will serve as a backup. Results showed that the accumulated 
delta-v method provided much more safety margin against early false detections than the acceleration 
method. Since the need for cutting the riser lines is measured in seconds or even minutes, there was no 
need to use the acceleration detection method to trigger this event. In addition, the delta-v threshold 
was set higher than the RCS cutoff trigger to increase the safety margin. 

The detection algorithms were tested in a variety of ways. Performance testing was simulated using 
LS-DYNA data to generate time histories for impact conditions, while safety assessments were done 
via simulating free-fall under the main parachutes in DSS. LS-DYNA is computationally intensive, so 



a parametric study was conducted, whereas DSS was run in a Monte Carlo fashion. To compliment the 
DSS simulation analysis, IMU data was collected from parachute drop tests that included both two and 
three-main chute scenarios. IMU data was also collected from vehicle mockup drop tests that 
complimented the LS-DYNA simulations. This IMU data was fed directly into the detection algorithm 
as if it were onboard during the test. All results showed solid performance. The trigger thresholds are 
set as input data, so that the values can be adjusted as more data becomes available. This paper further 
details the touchdown detection methods chosen and the analysis used to support the design. 
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Orion Crew Module (CM) touchdown detection is critical to activating the post-landing 
sequence that safe’s the Reaction Control Jets (RCS), ensures that the vehicle remains 
upright, and establishes communication with recovery forces. In order to accommodate safe 
landing of an unmanned vehicle or incapacitated crew, an onboard automated detection 
system is required. An Orion-specific touchdown detection algorithm was developed and 
evaluated to differentiate landing events from in-flight events. The proposed method will be 
used to initiate post-landing cutting of the parachute riser lines, to prevent CM rollover, and 
to terminate RCS jet firing prior to submersion. The RCS jets continue to fire until 
touchdown to maintain proper CM orientation with respect to the flight path and to limit 
impact loads, but have potentially hazardous consequences if submerged while firing. The 
time available after impact to cut risers and initiate the CM Up-righting System (CMUS) is 
measured in minutes, whereas the time from touchdown to RCS jet submersion is a function 
of descent velocity, sea state conditions, and is often less than one second. Evaluation of the 
detection algorithms was performed for in-flight events (e.g. descent under chutes) using hi- 
fidelity rigid body analyses in the Decelerator Systems Simulation (DSS), whereas water 
impacts were simulated using a rigid finite element model of the Orion CM in LS-DYNA. 
Two touchdown detection algorithms were evaluated with various thresholds: Acceleration 
magnitude spike detection, and Accumulated velocity changed (over a given time window) 
spike detection. Data for both detection methods is acquired from an onboard Inertial 
Measurement Unit (IMU) sensor. The detection algorithms were tested with analytically 
generated in-flight and landing IMU data simulations. The acceleration spike detection 
proved to be faster while maintaining desired safety margin. Time to RCS jet submersion 
was predicted analytically across a series of simulated Orion landing conditions. This paper 
details the touchdown detection method chosen and the analysis used to support the decision. 


Nomenclature 


TTS 

= time to thruster submersion 

LTD 

= time to detection 

CM 

= crew module 

Vn 

= normal velocity 

Vt 

= tangential velocity 

DSS 

= decelerator systems simulation 

MC 

= monte carlo 

RCS 

= reaction control system 

FE 

= finite element 

OIMU 

= Orion inertial measurement unit 

LOC 

= loss of crew 
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FOS 


factor of safety 


I. Introduction 

S PACECRAFT development is a complex and laborious process due to the difficulty in designing software, 
avionics, structures, and other systems to manage and withstand the extreme environments of the launch, ascent, 
orbit, descent, and landing phases of flight. The shear magnitude of spacecraft design typically dictates that many 
decisions must be made prior to manufacture of flight hardware and full system integration, which carries a certain 
level of risk. In addition, cost and schedule can limit the amount of testing and analysis available to assess and 
minimize risk. Thus, spacecraft developers must balance the knowledge that can be obtained via engineering tools, 
test, and judgment and the risk of failure due to remaining unknowns. 

Engineering analysis tools, such as trajectory simulators and finite element (FE) analysis, can provide critical 
insight into design performance and risk assessment prior to flight. During the development of the Apollo 
spacecraft, computer resources were prohibitively expensive and of limited capacity. Therefore, assessment of 
spacecraft performance relied heavily on full-scale testing, which was time consuming and did not elucidate the 
myriad of dynamic environments that encompassed the various phases of flight (ref). Advancements in computing 
technology and engineering analysis have changed the process of spacecraft design in the modern era and have 
proven reliable and valid when coupled with appropriate margins and factors of safety. 

The Orion crew module (CM) spacecraft is largely being designed by analysis. The competitive fiscal 
environment and aggressive development schedule have necessitated reliance on analytical engineering tools to 
answer critical design questions prior to ground tests and flight tests that will occur late in the design cycle. The 
current study is an example of utilizing several engineering tools and analytical methods along with limited test data, 
to address the specific problem of detecting Orion CM water impacts without the benefit of fully integrated flight 
test data. Accordingly, there were four goals of this study: 1) to evaluate the effectiveness of acceleration and 
change-in- velocity-based algorithms to detect analytically-generated Orion CM water impacts across a spectrum of 
simulated landing conditions, 2) to quantify the factors of safety in an early or missed detection, 3) to determine the 
likelihood of submerging the CM reaction control thrusters prior to detection and subsequent shutoff, and 4) 
quantify the factor of safety for an altitude-based backup timer for touchdown detection. The findings in this study 
were used to inform the Orion design team about the performance of automated touchdown detection and to quantify 
thruster submersion risk. 


II. Background 

Touchdown detection must be an automated process due to the short duration of the event and the possibility that 
the crew may be incapacitated upon landing and unable to perform manually designated tasks. Likewise, early flight 
tests will not have crew and require post-touchdown operations to be automated. There are two critical post-landing 
Orion functions that will be controlled by touchdown detection: 1) turning off the reaction control thrusters and 2) 
cutting the parachute riser lines. Each of these functions provides a boundary for the touchdown detection 
performance. Specifically, an algorithm that fails to reach a designated acceleration or change-in- velocity threshold 
would be a “no detect” whereas signaling a touchdown prior to water impact would be an “early false detect.” Each 
of these detection failures could result in different consequences and thus require quantification of a unique factor of 
safety. 

One of the most critical applications for the touchdown detection algorithm is mitigating the possibility of 
reaction control thruster firing during splashdown. The current Orion design will have roll, pitch, and yaw thrusters 
mounted around the CM outer mold line to control the vehicle attitude after the main parachutes have been 
deployed. The roll thrusters will be firing as needed to maintain vehicle heading with respect to the direction of 
travel. The roll thruster openings are low enough on the CM to warrant concern that they may be submerged while 
firing under certain landing conditions. In addition, the thrusters have not been tested in a submerged state and the 
affect of back pressure on the thruster opening while submerged is unknown. Due to the proximity of the roll 
thrusters to the CM pressure vessel, catastrophic failure of the thruster could potentially result in structural damage 
to the CM or loss of vehicle and crew (LOC). Failure in this scenario would be the “no detect” landings or 
conditions in which the detection algorithm was too slow in signaling thruster shutoff prior to water flow over the 
thruster opening. In addition, touchdown detection begins the post-landing sequence that includes the inflation of 
bags that will right the vehicle if it were to settle in the upside down position. Consequently, if touchdown is not 
detected, then the vehicle could remain upside down which is potentially life-threatening to the crew. 
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On the opposite side of the spectrum, detecting a CM acceleration or accumulated change in velocity at a 
threshold that is set too low could result in an “early false detect.” From trajectory and descent analyses, transient 
accelerations may exist that appear similar to a soft water landing due to high wind gusts or a late parachute 
opening. The main risk from this type of detection failure could be shutting down the RCS, and thus losing vehicle 
attitude control, or initiating release of the parachutes while above the waterline. For crewed flights, a delay timer is 
added to allow the Crew to be Prime for cutting the parachutes. An “early false detect” sets the lower end of the 
detection spectrum and carries its own factor of safety. Finding threshold settings that maximize factors of safety 
against an early false or a missed detection, and can reduce the likelihood of thruster submersion to below 1% was 
the main purpose of this analytical study, especially in the absence of applicable flight data. 


III. Algorithm Selection and Definition 

A. Touchdown Detection Requirements 

Orion has three primary touchdown detection-related requirements: 

• Automated detection within 5 seconds for cutting parachute riser lines. 

• The Crew Module Up-righting System (CMUS) must be activated within three minutes of touchdown 
(started immediately following release of the parachutes). 

• Reaction Control Jets (RCS) should be terminated prior to submersion with three-sigma reliability (TBR). 

B. Algorithm Selection Philosophy 

Since touchdown detection is a safety-critical task for both the Crew and the vehicle, it was desired to keep the 
method as simple and robust as possible. In addition, minimizing reliance on navigation parameters was preferred 
due to potential for corrupted data or data containing large errors. The most reliable navigation hardware, the on- 
board Inertial Measurement Unit (IMU), was selected for touchdown detection using sensed acceleration and change 
in velocity (delta- V) thresholds. Descriptions of the two algorithms evaluated are given is Section C. This approach 
was, however, not the only option for determining CM touchdown. For completeness, the following sections (1-3) 
provide rationales behind elimination of other potential methods for touchdown detection. 

1. Rationale for Not Using Nav Filtered or Measured Altitude 

The altitude options available for Orion are filtered Global Positioning System (GPS) data, GPS receiver output 
position converted directly to altitude, or baro altimeter measurements. Given the relatively slow descent rate under 
the Main parachutes and the accuracies of these measurements, a timer-based detection method would not satisfy the 
five second detection requirement and would certainly be too slow to shut down the RCS prior to submersion. Note 
however that this method is utilized as a backup (Section I). The altitude errors are in the hundreds of feet, clearly 
eliminating the possibility for a direct altitude check for touchdown detection. 

2. Rationale for Not Using Nav Filtered or Measured Altitude Rate 

Similarly to altitude, altitude rate is also available on Orion. While GPS altitude rate is usable with respect to the 
potential wave motion assumed (5-10 ft/s), and the baro-derived altitude rate may be usable, in keeping with 
protecting for corrupted navigation states, these options were also eliminated. In short, if the problem could be 
solved with less and more robust data, then that was the direction taken. 

3. Rationale for Not Using Saltwater Detectors 

Another potential mechanism for detecting touchdown is saltwater detectors. This method is used in the recovery 
system of the Shuttle Solid Rocket Boosters (SRB) (ref). The detectors are placed on the parachute riser lines so that 
the chutes can be safely cut away. This application will not work for Orion for two primary reasons: the addition of 
anything more on the riser lines was deemed unsafe by the chute development team, and it would take too long for 
the lines to hit the water (5 second requirement would not be met). The parachutes could easily flip the CM upside 
down before the riser lines made contact with the water. Additionally, there were no places on the vehicle structure 
that would provide reliable and timely contact, not to mention the potential issues with the thermal protection 
system. 
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C. Acceleration Magnitude and Accumulated Delta-V “Spike” Detection 

The two touchdown detection methods evaluated in this study were IMU-based acceleration magnitude and 
accumulated delta-v spike mapped via a lever-arm correction from the IMU location to the vehicle center of gravity 
(c.g.). In the case of acceleration spike detection, the magnitude of the sensed acceleration is compared to a given 
threshold (Figure la). If the threshold is tripped, touchdown is declared. In the case of accumulated delta-v 
detection, the change in velocity is accumulated over a window of time, and the magnitude of that delta-v is 
compared to a given threshold (Figure lb). If this threshold is tripped, touchdown is declared. It should be noted that 
neither of these algorithms require knowledge of the vehicle’s attitude. The accumulated delta-v was tested both by 
summing in the rotating IMU frame and an arbitrary inertial frame. The arbitrary inertial frame was “snapped” at the 
beginning of detection and the change in attitude was propagated with sensed IMU rates. Seven unique detection 
methods were evaluated for this study: three progressively increasing acceleration thresholds and two delta-v 
thresholds calculated in either the global (inertial) or CM body-fixed frames. 


(a) 


Accel Mag Spike Detection 



Figure 1: (a) Acceleration magnitude and (b) Accumulated delta-V magnitude "spike" detection 


D. Factor of Safety (FOS) Definition 

There are two primary areas of consideration with respect to margin or factor of safety (FOS) for touchdown 
detection: 1) “No Detection,” and 2) “Early False Detection.” A “No Detection” refers to the FOS between the 
effective algorithm threshold and the lowest anticipated landing acceleration or delta-v magnitude (Error! 
Reference source not found.). An “Early False Detection” refers to the difference between expected CM peak 
accelerations and changes-in- velocity under the parachutes prior to actual touchdown (Error! Reference source not 
found.). Clearly, the “False Detect” FOS should be as high as possible to protect against releasing the parachutes 
prematurely, while the “No Detect” FOS should be high for RCS cutoff to avoid potentially catastrophic jet firings 
underwater. Additionally, since shutting the RCS jets off early will eliminate the ability to perform roll orientation, a 
reasonable amount of “False Detect” FOS will also be desired. This deviation between cutting the chutes and RCS 
cutoff, precipitated the need for separate detection thresholds to allow for the proper prioritization of margin. 
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Figure 2: Factor of Safety Definitions for Touchdown Detection 


E. Backup Altitude Timer 

To protect for undetectable soft landings, the IMU-based automated touchdown detection is backed-up by an 
altitude timer. The timer is set with considerable margin and is based on the fall-time analysis done with the 
Decelerator Systems Simulation (DSS), and is bounded by the maximum time (three minutes) to begin CMUS 
activation to right the vehicle. Section G describes the fall-time analysis approach, and Section L details the results 
that were used to establish the backup timer value. 

F. Concept of Operations (Con-opts) 

One of the primary areas of contention for touchdown detection was Crew interaction. It was determined that if 
Crew were present, then there would be a delay timer that would allow them to activate or inhibit the segment 
transition to post-landing activities. In other words, the Crew would have time to confirm or override the automatic 
touchdown detection. For the case of un-crewed vehicles, the delay timer will be set to a small value or zero. Unlike 
detection for cutting the chutes, the RCS cutoff detection must be acted upon immediately so no delay timer is added 
to RCS termination. In addition to Crew interaction, logic was also added to inhibit detection until 30 seconds after 
the Main pilot chutes deploy, and when the altitude is below 1500 feet. This logic ensures that all the parachute dis- 
reefing is complete, and it minimizes the overall time that detection is occurring, thereby reducing the probability of 
early false detections. Figure 3 presents the overall touchdown Con-opts. 
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Figure 3: Touchdown Detection Concept of Operations 


IV. Analysis Approach 


G. CM Kinematics under the Parachutes 

In order to assess algorithm robustness to “Early False Detections” while descending under the parachutes, the 
NASA hi-fidelity Decelerator Systems Simulation (DSS) was utilized to quantify expected peak accelerations and 
changes in velocity. DSS trajectories include MC predictions of complete flight paths upon re-entry. However, for 
this study, logic was applied to limit detection until 30 seconds after the main pilot chutes deploy and when the 
altitude was below 1500 feet. Thus, assessment of in-flight CM accelerations and detla-v spikes were assumed to 
occur after all the parachute dis-reefmg was complete, which is currently the proposed method on Orion. To 
determine the maximum acceleration and delta-v spikes under parachutes (Figure 2), the touchdown detection 
algorithms (Section 5) were imbedded within the DSS Monte Carlo scripts, and evaluated across a set of six 
different scenarios with over a thousand runs for each scenario (Table 1). Scenarios encompassed variation in 
nominal chutes deployed, late chute inflations, chute failures, and extreme dispersions within the Global Reference 
Atmosphere Model (GRAM). In addition to capturing the maximum acceleration and delta-v spikes, these runs were 
also used to compute the maximum fall time from various altitudes. This information was used to establish the 
backup altitude-based timer value. Given altitude accuracy, the fall time could then be determined and the 
appropriate margin applied. 


Table 1: DSS Touchdown Detection Test Case Scenarios 


DSS Run Description 

Nominal 3 -mains 

3 -mains with one late chute inflation 

2- mains with one late chute inflation 

3 - mains with one chute failure 

3 -mains with GRAM rp scale 2.0 

3 -mains with GRAM rp scale 2.0 & increased vertical winds 
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H. Water Impact Dynamics 

Determination of “Late Detection for Thruster Cutoff’ and “No Detection” factors of safety required generation 
of CM landing acceleration time histories and a prediction of thruster submersion timing (TTS) across the spectrum 
of landing conditions. Similar to the in-flight CM kinematics assessment, Orion initial landing conditions were 
developed from DSS Monte Carlo simulations. A subset of the DSS cases was analyzed in the commercial finite 
element (FE) solver LS-DYNA (LSTC, Livermore CA) to generate training sets of acceleration time histories. 
Simulated landing results were then evaluated with the acceleration- and delta-v-based touchdown detection 
algorithms to determine time to detection (TTD) for various thresholds. Finally, mathematic extrapolation of the 
training set TTD and TTS results was performed via response surface approximation to predict “Late” and “No” 
detection factors of safety for the full suite of Monte Carlo landing cases. 

1. Orion Landing Conditions 

The Orion spacecraft is intended to descend nominally under three parachutes and land in the Pacific Ocean. A 
variety of sea state conditions may exist upon landing with specific wave velocities, slopes, and orientations with 
respect to the travel direction of the CM. In addition, the wind velocity and direction may affect the CM orientation 
(roll, pitch, or yaw) upon entry. Design Specification for Natural Environments (DSNE) was developed by NASA 
to approximate these conditions for different sea states in the Pacific based on previously collected field data (CxP 
70023 Section 3.5.18 and 3.6.18). A Monte Carlo probabilistic analysis was performed to combine the DSNE sea 
state information with the Orion parachute and thruster attitude control information to generate initial conditions for 
approximately 53,000 unique nominal three-parachute sea state three water landings. 

2. Generation of the Training Set 

Although the goal of this study was to assess the effectiveness of touchdown detection algorithms across the 
entire spectrum of nominal Orion landing conditions, developing acceleration time histories via FE analysis was 
impractical for the full set of Monte Carlo cases. Thus, it was necessary to select a smaller set of representative 
landing cases to define a training set for mathematical extrapolation to the full Monte Carlo set. Due to the 
complexity of fitting a mathematical surface to all Monte Carlo cases, landings were subdivided into “bins” based 
on ranges of horizontal velocities (V h ). Seven V h bins were designated with three bins representing sea states in 
which the winds were too low to necessitate vehicle orientation (noRCS) and four bins where RCS control was 
needed to orient the vehicle (withRCS). The number of Monte Carlo cases in each V h bin was proportional to the 
likelihood of occurrence. Thus, the number of cases in V h bins that more closely resembled expected nominal 
Pacific sea state conditions was far greater than the number of cases in the highest V h bins (Figure 4). 
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Figure 4: Scatter plot of Orion CM normal and tangential velocities for expanded set of -53,000 landing cases 
separated by horizontal velocity (V h ) bins. Number of cases per V h bin indicated in parentheses. Inset images 
(right) depicting typical CM water penetration in LS-DYNA for corresponding V h bins. 
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From previous analytical landing studies, the combination of high impact pitch angle and low entry velocity 
(normal to the wave surface) was known to produce small CM accelerations and therefore be at greater risk of “No 
Detection.” However, it was not known a priori what combination of low resultant acceleration and impact 
conditions (i.e. CM and wave orientation and velocities) would be a worst-case scenario for “Late” touchdown 
detection leading to thruster submersion. Due to the extensive run time and storage capacity requirements of long- 
duration FE landing simulations, generation of a comprehensive training set was divided into three phases. The first 
phase was exploratory, containing 100 cases in each V h bin around the perimeter of the normal velocity (V n )-theta 
plane (Figure 5). TTS and TTD results from the Phase I set were then used to populate an area-of-interest set of 150 
cases in the V n -theta region showing the lowest TTS/TTD margin. This was specifically to improve the accuracy of 
the mathematical extrapolation method in those regions. Finally, a third set of analyses was derived for each V h bin 
to populate the V n -theta plane with cases equally spaced along the V n and theta directions. 



Figure 5: Theta- V n scatter plot for a single V h bin depicting LS-DYNA cases in: phase I (100 exploratory, 
red), phase II (150 area-of-interest, black), and phase III (~80 equidistant, dark blue). Inset images depicting 
initial relative angle between sloped water and CM (theta). 

3. LS-DYNA Water Landing Simulations 

Orion water impacts were analyzed using the Arbitrary Eulerian-Lagrangian (ALE) fluid structure interaction 
module in the explicit FE solver LS-DYNA, version 9.7-1 (LSTC, Livermore, CA). A three-dimensional 
analytically rigid FE model of the Orion capsule was generated with equivalent mass and center of gravity to the 
latest flight design. A solid hexahedral mesh consisting of a void, or air, and water medium was generated to 
represent the ocean landing area (Figure 6a). Prior to each landing simulation, the Orion CM and water surface were 
oriented as a function of the MC-generated initial conditions. Ten unique impact variables specifying the CM 
orientation and velocity and wave initial state were used as inputs to each LS-DYNA analysis in the training sets. To 
generate acceleration time histories of the full landing event, all landing cases in the training set were run out to 1.5 
sec. LS-DYNA-generated CM resultant accelerations and velocities were extracted from the vehicle center of 
gravity and sub-sampled at 200 Hz to mimic the data collection frequency of the IMU. Roll control thruster cutouts 
were identified on the CM outer mold line (Figure 6b) for detection of water flow over the thruster. Thruster 
submersion timing was calculated as the difference in initial impact acceleration and the rise of sustained pressure 
sensed on either roll thruster location. 
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Figure 6: (a) LS-DYNA Orion CM FE model and landing simulation setup, (b) roll thruster footprints. 


4. Water Model Correlation 

Since the results of this analytical study were to assess the performance of the various touchdown detection 
algorithms, it was critical that the LS-DYNA-generated acceleration time histories and hydrodynamic flow around 
the CM were verified. A series of full-scale water drop tests were conducted prior to this study at the U.S. Army 
Proving Grounds in Aberdeen, MD. These tests consisted of a test article with comparable size, mass, and center of 
gravity to the Orion spacecraft. Tri-axial accelerometers were placed at the center of gravity, and at the top of the 
test article along the +Z and -Y axes (Figure 7a). To provide an estimate of roll thruster submersion timing during 
these tests, a pressure port was placed in the side of the test article at the equivalent location of a roll thruster on 
Orion. Pressure time histories were recorded throughout each drop test out to 1.5 seconds. For visualization, a 
camera was mounted on the side of the test article and oriented to view the thruster pressure port and edge of the 
heat shield (Figure 7b). 



Figure 7: (a) FE model of full-scale CM test article and depiction of experimental accelerometer locations, (b) 
CM-mounted camera view and pressure port. 


Ten unique vertical-only full-scale water impact tests were used for verification of the LS-DYNA acceleration 
predictions. Peak experimental and analytical X- and Z-axis (vertical and horizontal) accelerations were compared 
for each accelerometer and were found to be higher than experimental responses. Through an extensive model 
verification effort, this was found to be due to the coarseness of the LS-DYNA water mesh. Unfortunately, for the 
touchdown detection study, the relatively long run times (1.5 sec) and CM travel dictated a large pool and therefore 
a coarse water mesh. The discrepancy between test and analysis peak accelerations was quantified for all 10 drop 
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conditions and applied to the DYNA-generated acceleration time histories along each axis prior to processing 
through the detection algorithms. 

Similar to the acceleration discrepancies, coarseness of the water mesh resulted in a lag in the DYNA-predicted 
thruster submersion timing. However, the analytical hydrodynamics appeared to be visually similar to the 
experimental on-board video, indicating similarity in fluid flow around the CM upon impact. Due to the limited 
amount of tests used for model verification and the extent of landing conditions outside the full-scale test spectrum, 
a model uncertainty factor (MUF) of 50% was applied to the DYNA prediction time lag. This resulted in a MUF 
(i.e. specific time duration) which was subtracted from each DYNA-predicted TTS in the training set prior to 
comparison to detection timing. 

5. Touchdown Detection Matlab Simulation 

Orion IMU hardware and the seven unique flight software touchdown algorithms were simulated by a collection 
of Matlab scripts. The LS-DYNA generated acceleration and delta-v at the c.g. of the CM were mathematically 
transformed to the IMU location prior to evaluation of the applicable thresholds. The detection algorithm scripts 
were developed to allow multiple acceleration and accumulated delta-v thresholds to be explored, to evaluate 
various delta-v accumulation time windows, and to adjust filtering of rates and accelerations, lever-arm corrections, 
and threshold checking rates. The touchdown detection algorithms were applied to dynamical truth data or IMU data 
directly from both the DSS and LS-DYNA-generated acceleration and rate time histories. This setup closely mimics 
what is currently being implemented in the Orion Flight Software, which will be subsequently tested in the 
integrated hi-fidelity simulation. 

6. Generation of Expanded Set (Kriging) 

Extrapolation of training set cases to the larger expanded set of -53,000 landing cases was performed on the TTS 
results from LS-DYNA and the TTD results from the detection algorithm scripts. The Design and Analysis of 
Computer Experiments (DACE) Matlab toolbox was tailored to apply the constrained non-linear least squares fit 
Kriging approximation model to the landing inputs and outputs (Ref Lophaven et al.). The Kriging response surface 
was calculated between the relevant input parameters and each output parameter (i.e. TTS or a specific touchdown 
detection algorithm) independently. Outputs for the expanded set were then calculated for each horizontal velocity 
bin (e.g. all cases in V h bin #1) separately to reduce extrapolation complexity. To account for approximation errors, 
the maximum variance from the Kriging predictions was applied to each output to increase conservatism (i.e. TTS 
became faster and TTD became slower). This was performed to ensure the Kriging-extrapolated cases were 
conservative when compared to the training set cases. Performance of the acceleration and delta-v-based algorithms 
was evaluated with the Kriging-extrapolated CM kinematics by calculating factors of safety for “No Detection” and 
“Early False Detection” at the three-sigma boundary assuming a one-sided normal distribution (i.e. 99.86% pass). 
Thruster submersion while firing was calculated as a percentage of total Kriging cases to determine likelihood of 
occurrence. 


V. Results 


I. “No Detection” Factor of Safety 

Regardless of the algorithm method utilized, a threshold that is set too high to detect water impact can miss the 
event, resulting in a missed detection. Although the number of landing cases that missed detection were quantified 
for both the DYNA training and Kriging expanded sets (Figure 8), all FOS results were calculated with the Kriging 
set. FOS against a missed detection was calculated at the three-sigma boundary which resulted in allowance of 75 of 
53,000 (0.14%) missed detections. All three acceleration thresholds and delta-v threshold #1 allowed less than 1% 
missed detections whereas the delta-v threshold #2 allowed over 12% missed detections. Acceleration threshold #1 
only missed a single case and resulted in a 1.4 FOS against the three-sigma missed detection boundary (Table 2). 
Thresholds #2 and #3 missed 30 and 379 cases with three-sigma factors of safety of 1.06 and 0.85, respectively. The 
lower delta-v threshold had no missed detections and a 1.58 FOS whereas the higher delta-v threshold allowed 6,555 
missed detections, exceeding the three-sigma boundary with 0.94 FOS. 
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Figure 8: Plot of training set (LS-DYNA) and expanded set (Kriging) peak resultant acceleration values and 
acceleration-based algorithm thresholds. 


Table 2: Number of Kriging Cases with Missed Detections and Corresponding Factors of Safety for Each 
Touchdown Detection Algorithm 


Horizontal 
Velocity Bin 

Total Number of 
Cases 

# of Cases Missed 

Accel, 

Threshold #1 

Accel, 

Threshold #2 

Accel, 

Threshold #3 

Delta-V 
Threshold #1 

Delta-V 
Threshold #2 

Bin #1 

9567 

0 

0 

6 

0 

1501 

Bin #2 

11318 

0 

0 

1 

0 

2264 

Bin #3 

12959 

0 

0 

5 

0 

2567 

Bin #4 

13634 

1 

26 

294 

0 

221 

Bin #5 

4995 

0 

2 

68 

0 

2 

Bin #6 

733 

0 

2 

5 

0 

0 

Bin #7 

61 

0 

0 

0 

0 

0 

Total 

53267 

1 

30 

379 

0 

6555 

Likelihood 

0.00% 

0.06% 

0.71% 

0.00% 

12.31% 

No Detect FOS: 

1.40 

1.06 

0.85 

1.58 

0.94 

False Detect FOS: 

1.40 

1.86 

2.31 

1.13 

1.90 


J. “Early False Detection” Factor of Safety 

Results of the in-flight DSS-predicted CM kinematics were coupled with the Kriging-generated landing 
kinematics to evaluate FOS for “Early False Detection.” Acceleration-based algorithms had the highest “Early False 
Detection” factors of safety resulting in 1.4, 1.86, and 2.31 for thresholds #1, #2, and #3, respectively. The delta- v- 
based algorithms held a FOS of 1.13 and 1.9. Recall that the margin for RCS cutoff is biased more toward “No 
Detect” FOS. This is because there is currently a perceived larger threat to firing thrusters under water than 
terminating roll control early. Conversely, it is desired to place the maximum margin on “Early False Detection” to 
prevent premature release of the parachutes. It was also noted that the margins were slighting higher for the 
acceleration spike detection vs. the accumulated delta-v spike detection. Thus, while the delta-v algorithm with 
threshold #1 had the highest “No Detect” FOS (1.58), the “Early False Detect” FOS of 1.13 was lower than the 
acceleration-based algorithms. 

While the thresholds in Table 2 are those associated with the time to detection results in Table 3, the same data 
can be used to adjust the thresholds for the desire margin. Thus, it can be shown that an acceleration threshold for 
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parachute release can be chosen to achieve a “No Detect” FOS of -1.1 and an “Early False Detect” FOS of -1.8, 
while another can be chosen for RCS termination with an FOS of -1.5 and -1.3 respectively. 

K. Thruster Submersion Likelihood 

While the acceleration-based algorithms and low-threshold delta-v algorithms showed positive “No Detect” and 
“Early False Detect” factors of safety, the selected thresholds still needed to demonstrate positive margins for 
shutting off the roll thrusters prior to submersion. The number of Kriging cases in which the time to thruster 
submersion (TTS) was less than the time to touchdown detection (TTD) was quantified for each algorithm and 
threshold (Table 3). The acceleration-based algorithms were able to detect and shutdown the thrusters prior to 
submersion in all but one landing case (threshold #3) whereas the delta-v algorithms resulted in late detections in 
five and 5,313 cases with the lower and upper thresholds, respectively. 


Table 3: Number of training set (DYNA) cases in which thrusters were submerged before shutdown 


Horizontal 
Velocity Bin 

Total 

Number of 
Cases 

#of Cases 

Accel, 

Threshold #1 

Accel, 

Threshold #2 

Accel, 

Threshold #3 

Delta-V 
Threshold #1 

Delta-V 
Threshold #2 

Bin #1 

9567 

0 

0 

0 

0 

2465 

Bin #2 

11318 

0 

0 

0 

0 

599 

Bin #3 

12959 

0 

0 

0 

0 

205 

Bin #4 

13634 

0 

0 

1 

2 

1462 

Bin #5 

4995 

0 

0 

0 

2 

572 

Bin #6 

733 

0 

0 

0 

1 

10 

Bin #7 

61 

0 

0 

0 

0 

0 

Total 

53267 

0 

0 

1 

5 

5313 


Likelihood 

0.00% 

0.00% 

0.00% 

0.01% 

9.97% 


L. Backup Altitude-Based Timer Factor of Safety 

Since there is a maximum of three minutes allowed between water impact and the start of the CM up-righting 
system (CMUS), the amount of allowable margin on the backup altitude timer was also limited. The recorded fall 
times in the DSS simulations showed that there was a FOS of -1.6 to -2.0 depending on the altitude accuracy 
assumed near touchdown. 


VI. Forward Work 

While the design and analysis completed to date on the Orion touchdown detection algorithm is fairly mature 
and demonstrating promising performance, several items remain as forward work: 

• Finalize which method to use: Acceleration Spike or Accumulated Delta- V Spike. 

• Resolve a few remaining algorithm trades (additional filtering, protection for rotational acceleration 
computation, persistence checking etc.). 

• Analyze impact test and parachute drop test data to verify simulations. 

• Continue to refine LS-DYNA / Touchdown Detection simulations and analysis process. 

• Implement and test algorithm in Orion integrated verification simulation. 


VII. Conclusions 

Thus far, the touchdown detection analysis has shown promising results. Reasonable factors of safety have been 
achieved. It appears that the acceleration magnitude spike detection is superior to the accumulated delta-v spike 
detection in that while both had good threshold margins, the acceleration spike method performed better in 
terminating the RCS thrusters prior to submersion. In addition, the acceleration spike method is a substantially 
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simpler algorithm, especially with respect to the delta-v accumulated in an arbitrary inertial frame. Finally, the 
backup altitude-based timer showed to also have substantial margin with respect to the maximum allowable time 
prior to activating the CM up-righting system. Overall, the current touchdown detection design meets all 
requirements with sufficient margin. 
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